Repper privacy policy (draft)

Draft of 10 Oct 2026, company details filled in from FCMA's records on 11 Oct 2026, for FCMA's lawyer. Items in [brackets] still need their answers. Publish it at a public address before the App Store submission.

Who we are

Repper is published by FCMA Firstclass Management Agency Ltd, Alexandrou Ypsilanti 15A, Aradippou 7103, Larnaca, Cyprus, company number HE 466282 ("we"). Contact for anything about your data: liam@firstclassmanagementagency.com.

Without an account

Everything you log stays on your iPhone, in the app's own storage, protected by the phone's data protection. Nothing is sent anywhere. You can export it at any time (Settings, Your data).

With an account (optional)

An account keeps your training on every device you use. We keep:

• Your sign-in: your email address (for the sign-in email) or the identifier Apple gives us when you use Sign in with Apple.
• Your records: sessions and sets, plans, notes, check-ins, injuries, blood test bookings, medicines and practitioner notes you record, weigh-ins and body composition, and what you connect (below).
• A random identifier for each installation of the app, to keep your devices in step.

They are stored with Supabase, our database host, in the EU (Frankfurt). Each person's records are separated in the database itself, so one person's data cannot be read with another person's sign-in.

Connections you choose

• Offers and news by email: only if you tick "Email me offers and news". It is off by default, you can turn it off any time in Settings, and every email has an unsubscribe link. We never use your health or training data for marketing.
• Apple Health: with your permission, the app reads weight, body fat, lean mass, sleep, resting heart rate, steps and workouts, and writes each finished strength session as a workout. Data from Apple Health is never used for advertising or marketing, never sold, and is shared only with the processors needed for the features you use (our database host, and Anthropic if you allow the AI).
• WHOOP and Withings: if you connect them, we keep the access they grant on our server and fetch your sleep, recovery, heart rate variability, strain, workouts and body measurements (WHOOP) and weigh-ins (Withings). You can disconnect them in Settings at any time; their own privacy policies cover what they hold.
• A heart-rate sensor: the pulse during a session is read over Bluetooth on your phone and saved with that session.
• Claude (and other AI assistants you connect): if you connect Claude, through its connector sign-in or a key you make in the app, it can read your records and add notes, health entries, bloods, injuries, medicines and profile details through our server, as you, and only after you approve it. Claude's own privacy policy covers what Claude keeps of what you share with it. You can remove a key in Settings and the connection in Claude's connector settings.

The AI (optional, with your permission)

[Confirm the AI provider at release. Development builds use Google's free Gemini service, so this section describes the release plan.] Build my plan and the review of Recalibrate use an AI model (at release, Claude, made by Anthropic). Nothing is sent until you allow it in the app, and you can stop it in Settings. When it runs, we send Anthropic your Get to know me answers, your injuries, your latest weight, your recent sets and next sessions, and for the review your recent WHOOP nights and any blood test booking. Anthropic processes them to give the answer and, under its terms for its API, does not use them to train its models; it keeps them only as long as its terms allow [check Anthropic's current retention before publishing]. We record how much each AI request cost, to keep to a monthly limit, not what was in it.

What we do not do

No advertising. No analytics or tracking code. No selling or renting of data. No tracking across other companies' apps or websites.

Legal bases

We use your data to provide the service you ask for (contract). Health data is special-category data: we process it with your explicit consent, which you give by making an account and connecting services, and separately for the AI. You can withdraw consent at any time by disconnecting, stopping the AI, or deleting your account.

Your rights

• See and take your data: Settings, Your data, Export everything (a JSON file of every record).
• Correct it: edit it in the app.
• Delete it: Settings, Your account, Delete my account. This deletes your account and everything in it on our server at once. [Backups kept by our host roll off within their retention period, at most [7] days.]
• Object, restrict, complain: write to liam@firstclassmanagementagency.com. You may also complain to the Commissioner for Personal Data Protection in Cyprus.

Who processes data for us

• Supabase (database and sign-in, EU).
• Anthropic (the AI, only with your permission; United States, under [the EU standard contractual clauses / data privacy framework: confirm]).
• Apple (Sign in with Apple; Apple Health stays on your device unless you connect it).
• WHOOP and Withings act on their own account for the data they hold; we fetch from them only what you connect.

Children

Repper is not meant for anyone under 16.

Changes

We will update this page and its date when anything changes.